The main theme of the ISO 27001:2022 INFORMATION SECURITY, CYBERSECURITY AND PRIVACY PROTECTION MANAGEMENT SYSTEM, within the scope of Personal Data and Information Security Activities, is to demonstrate that information security management is ensured across people, infrastructure, software, hardware, organizational information, third-party information and financial resources; to safeguard risk management; to measure the performance of the information security management process; and to ensure the regulation of relationships with third parties on information security matters.

To this end, within the scope of our ISMS Policy;

• To protect information assets against any threat that may arise internally or externally, whether intentional or unintentional; to ensure the accessibility of information as required by business processes; to meet legal and regulatory requirements; and to carry out continuous improvement efforts.

• To manage personal data and information assets; to identify the security values, needs and risks of these assets; and to develop and implement controls for security risks.

• To ensure the continuity of the three fundamental elements of the INFORMATION SECURITY, CYBERSECURITY AND PRIVACY PROTECTION MANAGEMENT System in all activities carried out.

• Confidentiality: Preventing unauthorized access to information and information assets,

• Integrity: Demonstrating that the accuracy and integrity of information is ensured,

• Accessibility: Demonstrating that authorized persons can access information when required,

• To define the framework to be set out by the methods for determining personal data, information assets, their values, security needs, vulnerabilities, threats to assets and the frequency of these threats.

• To provide financial resources and personnel for the treatment of risks.

• To continuously monitor risks by reviewing technological expectations within the scope of the services provided.

• To fulfill the requirements of national or international regulations, laws and relevant legislation; to meet obligations arising from agreements; and to ensure the information security requirements arising from corporate responsibilities toward internal and external stakeholders.

• To reduce the impact of information security threats to service continuity and to contribute to that continuity.

• To prepare, maintain and test business continuity plans.

• To ensure environmental sustainability and to carry out environmentally conscious and socially responsible efforts with regard to climate change.

• To ensure continuous improvement.